Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (439 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2018-10168 1 Tp-link 1 Eap Controller 2024-11-21 N/A
TP-Link EAP Controller and Omada Controller versions 2.5.4_Windows/2.6.0_Windows do not control privileges for usage of the Web API, allowing a low-privilege user to make any request as an Administrator. This is fixed in version 2.6.1_Windows.
CVE-2018-10167 1 Tp-link 1 Eap Controller 2024-11-21 N/A
The web application backup file in the TP-Link EAP Controller and Omada Controller versions 2.5.4_Windows/2.6.0_Windows is encrypted with a hard-coded cryptographic key, so anyone who knows that key and the algorithm can decrypt it. A low-privilege user could decrypt and modify the backup file in order to elevate their privileges. This is fixed in version 2.6.1_Windows.
CVE-2018-10166 1 Tp-link 1 Eap Controller 2024-11-21 N/A
The web management interface in the TP-Link EAP Controller and Omada Controller versions 2.5.4_Windows/2.6.0_Windows does not have Anti-CSRF tokens in any forms. This would allow an attacker to submit authenticated requests when an authenticated user browses an attack-controlled domain. This is fixed in version 2.6.1_Windows.
CVE-2018-10165 1 Tp-link 1 Eap Controller 2024-11-21 N/A
Stored Cross-site scripting (XSS) vulnerability in the TP-Link EAP Controller and Omada Controller versions 2.5.4_Windows/2.6.0_Windows allows authenticated attackers to inject arbitrary web script or HTML via the userName parameter in the local user creation functionality. This is fixed in version 2.6.1_Windows.
CVE-2018-10164 1 Tp-link 1 Eap Controller 2024-11-21 N/A
Stored Cross-site scripting (XSS) vulnerability in the TP-Link EAP Controller and Omada Controller versions 2.5.4_Windows/2.6.0_Windows allows authenticated attackers to inject arbitrary web script or HTML via the implementation of portalPictureUpload functionality. This is fixed in version 2.6.1_Windows.
CVE-2017-15637 1 Tp-link 76 Er5110g, Er5110g Firmware, Er5120g and 73 more 2024-11-21 N/A
TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the pptphellointerval variable in the pptp_server.lua file.
CVE-2017-15636 1 Tp-link 76 Er5110g, Er5110g Firmware, Er5120g and 73 more 2024-11-21 N/A
TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-time variable in the webfilter.lua file.
CVE-2017-15635 1 Tp-link 76 Er5110g, Er5110g Firmware, Er5120g and 73 more 2024-11-21 N/A
TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the max_conn variable in the session_limits.lua file.
CVE-2017-15634 1 Tp-link 76 Er5110g, Er5110g Firmware, Er5120g and 73 more 2024-11-21 N/A
TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the name variable in the wportal.lua file.
CVE-2017-15633 1 Tp-link 76 Er5110g, Er5110g Firmware, Er5120g and 73 more 2024-11-21 N/A
TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-ipgroup variable in the session_limits.lua file.
CVE-2017-15632 1 Tp-link 76 Er5110g, Er5110g Firmware, Er5120g and 73 more 2024-11-21 N/A
TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-mppeencryption variable in the pptp_server.lua file.
CVE-2017-15631 1 Tp-link 76 Er5110g, Er5110g Firmware, Er5120g and 73 more 2024-11-21 N/A
TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-workmode variable in the pptp_client.lua file.
CVE-2017-15630 1 Tp-link 76 Er5110g, Er5110g Firmware, Er5120g and 73 more 2024-11-21 N/A
TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-remotesubnet variable in the pptp_client.lua file.
CVE-2017-15629 1 Tp-link 76 Er5110g, Er5110g Firmware, Er5120g and 73 more 2024-11-21 N/A
TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-tunnelname variable in the pptp_client.lua file.
CVE-2017-15628 1 Tp-link 76 Er5110g, Er5110g Firmware, Er5120g and 73 more 2024-11-21 N/A
TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the lcpechointerval variable in the pptp_server.lua file.
CVE-2017-15627 1 Tp-link 76 Er5110g, Er5110g Firmware, Er5120g and 73 more 2024-11-21 N/A
TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-pns variable in the pptp_client.lua file.
CVE-2017-15626 1 Tp-link 76 Er5110g, Er5110g Firmware, Er5120g and 73 more 2024-11-21 N/A
TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-bindif variable in the pptp_server.lua file.
CVE-2017-15625 1 Tp-link 76 Er5110g, Er5110g Firmware, Er5120g and 73 more 2024-11-21 N/A
TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-olmode variable in the pptp_client.lua file.
CVE-2017-15624 1 Tp-link 76 Er5110g, Er5110g Firmware, Er5120g and 73 more 2024-11-21 N/A
TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-authtype variable in the pptp_server.lua file.
CVE-2017-15623 1 Tp-link 76 Er5110g, Er5110g Firmware, Er5120g and 73 more 2024-11-21 N/A
TP-Link WVR, WAR and ER devices allow remote authenticated administrators to execute arbitrary commands via command injection in the new-enable variable in the pptp_server.lua file.